Palo Alto Networks says attackers are actively exploiting the PHP2Shell vulnerabilities against internet-exposed PAN-OS management interfaces, and its Unit 42 team has independently verified the tooling and results described by Dream Research. In an October 29 update, the company said about 0.02% of its global installed base had been affected and that it had contacted each impacted customer.
Dream’s investigation describes a custom attack chain that combines PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, with the Linux kernel privilege-escalation flaw Fragnesia, CVE-2026-46300. The chain gave attackers root access to 24 perimeter firewalls and one internal firewall management server across the United States, Japan, Taiwan and South Korea. Three of the compromised systems were in a US government-affiliated environment, although the organization has not been identified. The findings are detailed in Dream Research’s updated report and add new details to the PHP2Shell and Fragnesia exploit chain.
Dream says the attackers extracted an LDAP service account password from the compromised management server, queried Active Directory for users and groups, and attempted password spraying and the creation of backdoor accounts. The researchers could not determine whether those later attempts succeeded, so the full extent of access inside the government-affiliated network remains unknown. Dream also said 22 other compromised firewalls were left with webshells and no further post-exploitation activity was observed on them.
Palo Alto’s security advisory clarifies that the vulnerability affects the PAN-OS management web interface, including its HTTPS interface and XML API. The company says the GlobalProtect portal, gateway and Clientless VPN are not affected. Branch-specific fixes are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, and the advisory lists the minimum fixed versions for each release line.
Unit 42 says customers who installed the available patches are not affected because the fixes interrupt the observed exploit chain. Palo Alto recommends removing public internet access to management interfaces and limiting administration to trusted internal IP addresses. Its October 29 threat brief says the company continues to investigate the activity and has individually contacted affected customers.
Dream observed Claude Code and the Chinese AI models DeepSeek and Kimi in the attacker’s environment, but said it had no direct evidence that AI tools wrote the exploit or the post-exploitation scripts. The researchers have not attributed the operation to a named threat group.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
